Combining filtering and statistical methods for anomaly detection

Soule, Augustin; Salamatian, Kavé; Taft, Nina

doi:10.1145/1330107.1330147

Cited by 235 publications

(169 citation statements)

References 0 publications

Supporting

Mentioning

151

Contrasting

Unclassified

Order By: Relevance

“…In this model we assume that the state-noise W t and the measurement-noise V t are uncorrelated zero-mean gaussian white-noise processes with covariance matrices Q t and R t , respectively. For a full understanding of these system, we refer the reader to our work in [4]. Since we have found a model and system equations for our system, next we need to deal properly with the different steps of our optimization algorithm for anomaly decision issue.…”

Section: Methodsmentioning

confidence: 99%

“…Our study is built on traffic matrix scheme [2], [4]. Each traffic matrix entries describes the average volume of traffic, in a given time interval, that originates at a given source node (routers) and is headed towards a particular destination node.…”

Section: Introductionmentioning

confidence: 99%

“…In [4], we used traffic matrix at the granularity of OD flows to detect, identify and track anomalies, by comparing four schemes (a basic analysis using variance, the CUSUM and Generalized Likelihood Ration test combined, Wavelets and a fourth method based multi scale variance shift). We had shown that the basic analysis using variance performs the best above the four methods, in the case of real network data (Abilene).…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

A Robust Anomaly Detection Technique Using Combined Statistical Methods

Ndong

Salamatian

2011

2011 Ninth Annual Communication Networks and Services Research Conference

Self Cite

View full text Add to dashboard Cite

Section: Methodsmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

A Robust Anomaly Detection Technique Using Combined Statistical Methods

Ndong

Salamatian

2011

2011 Ninth Annual Communication Networks and Services Research Conference

Self Cite

View full text Add to dashboard Cite

“…of packets, bytes, or new flows) and/or particular traffic features (e.g., distribution of IP addresses and ports), using either single-link measurements or network-wide data. A non-exhaustive list of standard methods includes the use of signal processing techniques (e.g., ARIMA modeling, wavelets-based filtering) on single-link traffic measurements [1], Kalman filters [4] for network-wide anomaly detection, and Sketches applied to IP-flows [5,6].…”

Section: Related Work and Contributionsmentioning

confidence: 99%

UNADA: Unsupervised Network Anomaly Detection Using Sub-space Outliers Ranking

Casas

Mazel

Owezarski

2011

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Abstract. Current network monitoring systems rely strongly on signature-based and supervised-learning-based detection methods to hunt out network attacks and anomalies. Despite being opposite in nature, both approaches share a common downside: they require the knowledge provided by an expert system, either in terms of anomaly signatures, or as normal-operation profiles. In a diametrically opposite perspective we introduce UNADA, an Unsupervised Network Anomaly Detection Algorithm for knowledge-independent detection of anomalous traffic. UNADA uses a novel clustering technique based on Sub-Space-Density clustering to identify clusters and outliers in multiple low-dimensional spaces. The evidence of traffic structure provided by these multiple clusterings is then combined to produce an abnormality ranking of traffic flows, using a correlation-distance-based approach. We evaluate the ability of UNADA to discover network attacks in real traffic without relying on signatures, learning, or labeled traffic. Additionally, we compare its performance against previous unsupervised detection methods using traffic from two different networks.

show abstract

“…To evaluate the performance of AR prediction, EWMA and NSHW methods, anomalies from either real traffic data or synthetic anomaly generator can be used [5], [9], [10]. Because the exact statistical properties of anomalies are too difficult to be simulated, and A. Soule et al [10] has shown that the synthetic anomalies may result in a reversed result to the real anomalies for evaluating anomaly detection methods, we will use the real traffic collected on different links of SINET3 to evaluate the AR prediction method comparing with EWMA and NSHW methods.…”

Section: B Nshwmentioning

confidence: 99%

A Traffic Decomposition and Prediction Method for Detecting and Tracing Network-Wide Anomalies

Abe

et al. 2009

IEICE Trans. Inf. & Syst.

View full text Add to dashboard Cite

SUMMARYTraffic volume anomalies refer to apparently abrupt changes in the time series of traffic volume, which can propagate through the network. Detecting and tracing these anomalies is a critical and difficult task for network operators. In this paper, we first propose a traffic decomposition method, which decomposes the traffic into three components: the trend component, the autoregressive (AR) component, and the noise component. A traffic volume anomaly is detected when the AR component is outside the prediction band for multiple links simultaneously. Then, the anomaly is traced using the projection of the detection result matrices for the observed links which are selected by a shortest-path-first algorithm. Finally, we validate our detection and tracing method by using the real traffic data from the third-generation Science Information Network (SINET3) and show the detected and traced results.

show abstract

Combining filtering and statistical methods for anomaly detection

Cited by 235 publications

References 0 publications

A Robust Anomaly Detection Technique Using Combined Statistical Methods

A Robust Anomaly Detection Technique Using Combined Statistical Methods

UNADA: Unsupervised Network Anomaly Detection Using Sub-space Outliers Ranking

A Traffic Decomposition and Prediction Method for Detecting and Tracing Network-Wide Anomalies

Contact Info

Product

Resources

About